Question 1

What are Information Society Services'? Select the INCORRECT answer

Accepted Answer

D

Explanation: An 'Information Society Service' (ISS), as defined by EU law, is any service normally provided for remuneration, at a distance, by electronic means, and at the individual request of a recipient. The term 'remuneration' is interpreted broadly to include services funded indirectly, for example, through advertising revenue. Therefore, services provided by non-profit or government organizations that involve no economic activity or remuneration (neither direct nor indirect) do not meet the definition of an ISS. Options A, B, and C all describe services that fall within this definition, making option D the incorrect statement.

Question 2

Which of the below would be the BEST example of processing that could utilise the Public Interest Task lawful basis?

Accepted Answer

C

Explanation: The collection of council tax is a statutory duty performed by a local authority. This processing is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in the controller (the local authority). This aligns directly with the definition of the 'Public Interest Task' lawful basis under GDPR Article 6(1)(e). This is a core, non-commercial function of a public body mandated by law, making it the clearest and most appropriate example among the choices.

Question 3

How are data sharing practices governed by data protection law?

Accepted Answer

A

Explanation: Data sharing is a form of processing personal data and is therefore governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Section 121 of the DPA 2018 specifically mandates the Information Commissioner to prepare a statutory code of practice that provides practical guidance on sharing personal data in compliance with data protection legislation. This "Data sharing: a code of practice" has been issued by the Information Commissioner's Office (ICO) and was laid before the UK Parliament, giving it statutory force. It clarifies how the principles and obligations of the DPA 2018 apply to data sharing scenarios.

Question 4

What does NOT have an exemption prescribed under schedule 3 of the Data Protection Act 2018?

Accepted Answer

B

Explanation: Schedule 3 of the Data Protection Act 2018 provides specific exemptions from certain GDPR provisions, primarily concerning the rights of data subjects. This schedule is explicitly titled "Exemptions etc from the GDPR: health, social work, education and child abuse data." A review of the schedule's contents confirms that it details exemptions for health data (Part 2), social work data (Part 3), and education data, including examination scripts and marks (Part 4). Credit checking agency data is not mentioned within Schedule 3. Any applicable exemptions for credit reference agencies are found elsewhere in the Act, such as in Schedule 2, which covers a broader range of processing purposes.

Question 5

Two businesses decide to work together to sell their products by mail order Orders are made via a
single online website and they each use their existing employees to administer and update each
other's orders on a single order system regardless of product.
Which of the below is CORRECT of the roles of the two businesses in relation to the single order
system'?

Accepted Answer

D

Explanation: The two businesses are joint controllers because they jointly determine the purposes and means of processing personal data. They have a common purpose (selling products together via mail order) and have jointly decided on the means (a single website and a single order system). The fact that employees from both companies can administer all orders on this shared system further demonstrates this joint control over the processing activities. This arrangement fits the definition of joint controllership as outlined in Article 26 of the GDPR, where multiple entities collaborate on the essential decisions about data processing.

Question 6

Where a processor engages another processor ("sub-processor") to carry out processing activities on behalf of a controller, which of the following statements is CORRECT?

Accepted Answer

A

Explanation: According to Article 28(2) of the General Data Protection Regulation (GDPR), a processor is explicitly prohibited from engaging another processor (a sub-processor) without obtaining prior written authorisation from the controller. This authorisation can be either specific to a particular sub-processor or a general written authorisation for the processor to engage sub-processors. In the case of a general authorisation, the processor must inform the controller of any changes, giving the controller the opportunity to object. This requirement ensures the controller maintains ultimate control and awareness over who is processing the personal data for which they are responsible.

Question 7

Where are the definitions of "Public Authority" and "Public Bodies" found?

Accepted Answer

A

Explanation: The definitions for "Public Authority" and "Public Body" in the UK information rights framework are found in both the Data Protection Act (DPA) 2018 and the Freedom of Information Act (FOIA) 2000. The DPA 2018, in Section 7, provides a specific definition for the purposes of data protection law. Crucially, this definition explicitly incorporates the definition of a "public authority" as established in the Freedom of Information Act 2000. The FOIA 2000, in its Section 3 and Schedule 1, provides the foundational list and criteria for what constitutes a public authority in the UK. Therefore, to fully understand the scope of these terms, both Acts must be consulted.

Question 8

How does the GDPR relate to cookies?

Accepted Answer

A

Explanation: The General Data Protection Regulation (GDPR) applies specifically to the processing of personal data. While the placement of cookies is governed by the Privacy and Electronic Communications Regulations (PECR), the GDPR becomes applicable the moment a cookie processes information that qualifies as personal data. This includes online identifiers such as cookie IDs, IP addresses, or device IDs, which can be used to single out an individual. If a cookie is used solely for functions that do not involve personal data (e.g., storing a non-identifiable language preference), then the specific processing rules of the GDPR would not apply to that data, although PECR's consent rules for placing the cookie still would.

Question 9

Under which circumstances can the 'domestic purposes' exemption be used to justify non-
compliance with the Data Protection Act 2018?
A) An individual sells make up products for commission and uses social media to promote products
to friends and family
B) A couple are planning their daughter's wedding and use excel to store contact details and dietary
needs of the guests
C) An individual employs a babysitter and stores her bank details in an encrypted document in order
to make payments
D) A pansh council keeps a spreadsheet to manage bookings of the village hall, it contains only
contact information and time slots
E) A group of students are arranging a house party and using social media to invite people that they
do and do not know

Accepted Answer

C

Explanation: The 'domestic purposes' exemption, established under Article 2(2)(c) of the UK GDPR and reflected in the Data Protection Act 2018, applies only when a natural person processes data in the course of a "purely personal or household activity." Planning a family wedding (B) and managing the employment of a babysitter for one's own household (C) are quintessential examples of such activities. The processing is confined to a private, domestic sphere. The exemption does not cover commercial activities, processing by public authorities, or activities that make personal data publicly available to an indefinite number of people, as these fall outside the scope of a 'purely' personal or household context.

Question 10

You are a consulting Data Protection Officer (DPO) for a holiday resort You have been asked to
conduct a Data Protection Impact Assessment (DPIA) for them in advance of adopting a new HR
management database.
While working through the DPIA, which of the following is NOT a requirement?

Accepted Answer

D

Explanation: A Data Protection Impact Assessment (DPIA) is a mandatory internal process under the GDPR for high-risk processing. It requires a systematic description of the processing (A), the identification of measures to mitigate risks (C), and a formal sign-off and recording of outcomes for accountability (B). However, there is no legal requirement to publish the potential risks identified during this internal assessment in a public-facing information (privacy) notice. While transparency is key, the privacy notice's purpose is to inform individuals about the nature of the processing, their rights, and the legal basis, not to detail the internal risk management process. Publishing such risks could be counterproductive and is not mandated by GDPR Articles 13 or 14.

Free BCS PDP9 Actual Exam Questions